# Magick.NET-Q16-HDRI-OpenMP-x64 (NuGet) vulnerabilities

94 known vulnerabilities (1 critical, 19 high, 66 medium, 7 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 15.1.0 (Nov 5, 2026): no advisory affects it
- Newest unaffected release: 15.1.0 (Nov 5, 2026), the latest release
- Releases: 121 since 7.14.0 (Jun 16, 2019)
- Registry: https://www.nuget.org/packages/Magick.NET-Q16-HDRI-OpenMP-x64
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-56372: 7.14.0 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56373: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56374: 7.14.0 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56362: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56365: 7.14.0 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56364: 7.14.0 to 14.10.1 (14.10.2 is outside it)
- CVE-2026-56361: 7.14.0 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56370: 7.14.0 to 14.11.1 (14.12.0 is outside it)
- CVE-2026-56368: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56379: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56376: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56371: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56378: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-56367: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-46559: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46557: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46521: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46520: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45664: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46522: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45624: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45359: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45358: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-42326: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-45031: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-46523: 7.14.0 to 14.13.0 (14.13.1 is outside it)
- CVE-2026-32636: 7.14.0 to 14.10.4 (14.11.0 is outside it)
- CVE-2026-31853: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30937: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30936: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30935: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30931: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30929: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-30883: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28693: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28692: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28691: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28690: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28689: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28688: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28687: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28686: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28494: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-28493: 7.14.0 to 14.10.3 (14.10.4 is outside it)
- CVE-2026-27799: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-27798: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26983: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26284: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26283: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-26066: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25989: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25988: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25987: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25986: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25985: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25983: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25982: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25971: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25970: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25969: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25968: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25967: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25965: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25898: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25897: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25799: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25798: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25797: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25796: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25795: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25794: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25638: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-25637: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-24485: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-24484: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-24481: 7.14.0 to 14.10.2 (14.10.3 is outside it)
- CVE-2026-23952: 7.14.0 to 14.10.1 (14.10.2 is outside it)
- CVE-2026-23874: 7.14.0 to 14.10.1 (14.10.2 is outside it)
- CVE-2026-22770: 7.14.0 to 14.10.1 (14.10.2 is outside it)
- CVE-2025-68950: 7.14.0 to 14.10.0 (14.10.1 is outside it)
- CVE-2025-68618: 7.14.0 to 14.10.0 (14.10.1 is outside it)
- CVE-2025-68469: 7.14.0 to 13.1.3 (13.2.0 is outside it)
- CVE-2025-62594: 7.14.0 to 14.9.0 (14.9.1 is outside it)
- CVE-2025-57807: 7.14.0 to 14.8.1 (14.8.2 is outside it)
- CVE-2025-55298: 7.14.0 to 14.8.0 (14.8.1 is outside it)
- CVE-2025-55212: 7.14.0 to 14.8.0 (14.8.1 is outside it)
- CVE-2025-55160: 7.14.0 to 14.7.0 (14.8.0 is outside it)
- CVE-2025-55154: 7.14.0 to 14.7.0 (14.8.0 is outside it)
- CVE-2025-55004: 7.14.0 to 14.7.0 (14.8.0 is outside it)
- CVE-2025-53101: 7.14.0 to 14.6.0 (14.7.0 is outside it)
- CVE-2025-53019: 7.14.0 to 14.6.0 (14.7.0 is outside it)
- CVE-2025-53015: 7.14.0 to 14.6.0 (14.7.0 is outside it)
- CVE-2025-53014: 7.14.0 to 14.6.0 (14.7.0 is outside it)
- CVE-2023-1289: 7.14.0 to 12.3.0 (13.0.0 is outside it)

## Advisories (94)

### [CVE-2026-56372](https://cve.now/CVE-2026-56372): ImageMagick - Heap Buffer Overflow Read via Unrecognized Magnify Method

- Severity: Medium 4.8
- Published: Jul 11, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 89 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56373](https://cve.now/CVE-2026-56373): ImageMagick - Use-After-Free Write in PDB Decoder

- Severity: Medium 6.3
- Published: Jul 10, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 137 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56374](https://cve.now/CVE-2026-56374): ImageMagick - Heap Buffer Overflow in FTXT Encoder via format Parameter

- Severity: Medium 4.8
- Published: Jul 8, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 86 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56362](https://cve.now/CVE-2026-56362): ImageMagick - Heap-buffer-overflow Read in GetPixelIndex via OpenPixelCache Metadata Desynchronization

- Severity: Low 2.1
- Published: Jul 8, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 135 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56365](https://cve.now/CVE-2026-56365): ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing

- Severity: Medium 6.3
- Published: Jun 30, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56364](https://cve.now/CVE-2026-56364): ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML

- Severity: Low 1.8
- Published: Jun 30, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 162 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56361](https://cve.now/CVE-2026-56361): ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing

- Severity: Medium 4.8
- Published: Jun 30, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 78 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56370](https://cve.now/CVE-2026-56370): ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact

- Severity: Medium 4.8
- Published: Jun 24, 2026
- Affected: fixed in 14.12.0.
- Fixed in 14.12.0 (released Apr 13, 2026, 72 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56368](https://cve.now/CVE-2026-56368): ImageMagick - Memory Leak in Raw Pixel Data Coders

- Severity: Medium 6.3
- Published: Jun 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 121 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56379](https://cve.now/CVE-2026-56379): ImageMagick - Command Injection via SVG Decoder

- Severity: Critical 9.2
- Published: Jun 23, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56376](https://cve.now/CVE-2026-56376): ImageMagick - Heap Use-After-Free in Meta Coder

- Severity: Medium 6.3
- Published: Jun 23, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56371](https://cve.now/CVE-2026-56371): ImageMagick - Memory Leak in TXT File Processing via Texture Attribute

- Severity: Medium 6.9
- Published: Jun 23, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 120 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56378](https://cve.now/CVE-2026-56378): ImageMagick - Heap Out-of-Bounds Read in PCD Decoder

- Severity: Medium 6.3
- Published: Jun 21, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 118 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-56367](https://cve.now/CVE-2026-56367): ImageMagick - Heap Out-of-Bounds Read in PSB RLE Decoding

- Severity: Medium 6.3
- Published: Jun 21, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 118 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46559](https://cve.now/CVE-2026-46559): ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder

- Severity: Medium 4.0
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46557](https://cve.now/CVE-2026-46557): ImageMagick: Stack overflow in fx operation

- Severity: Medium 6.2
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46521](https://cve.now/CVE-2026-46521): ImageMagick: Heap Buffer Over-Write in MIFF encoder when using LZMA compression

- Severity: Medium 5.5
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46520](https://cve.now/CVE-2026-46520): ImageMagick: Heap Buffer Over-Write in IPL decoder when reading multiple images of different dimensions

- Severity: High 7.5
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45664](https://cve.now/CVE-2026-45664): ImageMagick: Policy Bypass in MNG coder could

- Severity: Medium 5.3
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46522](https://cve.now/CVE-2026-46522): ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion

- Severity: High 7.5
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45624](https://cve.now/CVE-2026-45624): ImageMagick: Heap Buffer Over-Read of a 4 bytes in distort operation.

- Severity: Medium 5.1
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45359](https://cve.now/CVE-2026-45359): ImageMagick: Out-of-Bounds Read in connected components when the user supplies an invalid keep-top define

- Severity: Medium 5.7
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45358](https://cve.now/CVE-2026-45358): ImageMagick: Out-of-Bounds Read of a single byte in meta encoder

- Severity: Medium 5.3
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-42326](https://cve.now/CVE-2026-42326): ImageMagick: Heap Buffer Over-Read in IPTC encoder

- Severity: Medium 5.1
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-45031](https://cve.now/CVE-2026-45031): ImageMagick: Policy Bypass in PSD decoder

- Severity: Medium 5.3
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-46523](https://cve.now/CVE-2026-46523): ImageMagick: Use-After-Free in MSL decoder.

- Severity: Medium 6.2
- Published: Jun 10, 2026
- Affected: fixed in 14.13.1.
- Fixed in 14.13.1 (released May 17, 2026, 24 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-32636](https://cve.now/CVE-2026-32636): ImageMagick has a heap-buffer-overflow in NewXMLTree which could result in crash

- Severity: Medium 5.3
- Published: Mar 18, 2026
- Affected: fixed in 14.11.0.
- Fixed in 14.11.0 (released Mar 16, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-31853](https://cve.now/CVE-2026-31853): ImageMagick has a heap buffer over-write on 32-bit systems in SFW decoder

- Severity: Medium 5.7
- Published: Mar 11, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30937](https://cve.now/CVE-2026-30937): ImageMagick has a heap buffer overflow in WriteXWDImage due to CARD32 arithmetic overflow in bytes\_per\_line calculation

- Severity: Medium 6.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30936](https://cve.now/CVE-2026-30936): ImageMagick has a heap Buffer Overflow in WaveletDenoiseImage

- Severity: Medium 5.5
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30935](https://cve.now/CVE-2026-30935): ImageMagick has a heap Buffer Over-Read in BilateralBlurImage

- Severity: Medium 4.4
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30931](https://cve.now/CVE-2026-30931): ImageMagick has a heap-based buffer overflow in UHDR encoder

- Severity: Medium 6.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30929](https://cve.now/CVE-2026-30929): ImageMagick has a stack buffer overflow in MagnifyImage

- Severity: High 7.7
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-30883](https://cve.now/CVE-2026-30883): ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder

- Severity: Medium 5.7
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28693](https://cve.now/CVE-2026-28693): ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write

- Severity: High 8.1
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28692](https://cve.now/CVE-2026-28692): ImageMagick has a heap buffer over-read via 32-bit integer overflow in MAT decoder

- Severity: Medium 4.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28691](https://cve.now/CVE-2026-28691): ImageMagick has an uninitialized pointer dereference in JBIG decoder

- Severity: High 7.5
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28690](https://cve.now/CVE-2026-28690): ImageMagick has a stack write buffer overflow in MNG encoder

- Severity: Medium 6.9
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28689](https://cve.now/CVE-2026-28689): ImageMagick has a Path Policy TOCTOU symlink race bypass

- Severity: Medium 6.3
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28688](https://cve.now/CVE-2026-28688): ImageMagick has a heap use-after-free in the MSL encoder

- Severity: Medium 4.0
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28687](https://cve.now/CVE-2026-28687): ImageMagick has a Heap Use-After-Free in ImageMagick MSL decoder

- Severity: Medium 5.3
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28686](https://cve.now/CVE-2026-28686): ImageMagick has a write heap-buffer-overflow in PCL encoder via undersized output buffer

- Severity: Medium 6.8
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28494](https://cve.now/CVE-2026-28494): ImageMagick affected by stack corruption through long morphology kernel names or arrays

- Severity: High 7.1
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-28493](https://cve.now/CVE-2026-28493): ImageMagick has a Integer Overflow leading to out of bounds write in SIXEL decoder

- Severity: Medium 6.5
- Published: Mar 9, 2026
- Affected: fixed in 14.10.4.
- Fixed in 14.10.4 (released Mar 9, 2026, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-27799](https://cve.now/CVE-2026-27799): ImageMagick has a heap Buffer Over-read in its DJVU image format handler

- Severity: Medium 4.0
- Published: Feb 25, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-27798](https://cve.now/CVE-2026-27798): ImageMagick: Heap Buffer Over-read in WaveletDenoise when processing small images

- Severity: Medium 4.0
- Published: Feb 25, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 2 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26983](https://cve.now/CVE-2026-26983): ImageMagick: Invalid MSL \<map\> can result in a use after free

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26284](https://cve.now/CVE-2026-26284): ImageMagick has heap overflow in pcd decoder that leads to out of bounds read.

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26283](https://cve.now/CVE-2026-26283): ImageMagick has possible infinite loop in JPEG encoder when using \`jpeg:extent\`

- Severity: Medium 6.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-26066](https://cve.now/CVE-2026-26066): ImageMagick has infinite loop when writing IPTCTEXT leads to denial of service via crafted profile

- Severity: Medium 6.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25989](https://cve.now/CVE-2026-25989): ImageMagick has integer overflow or wraparound and incorrect conversion between numeric types in the internal SVG decoder

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25988](https://cve.now/CVE-2026-25988): ImageMagick's MSL image stack index not refreshed, leading to leaked images.

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25987](https://cve.now/CVE-2026-25987): ImageMagick has heap buffer over-read in MAP image decoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25986](https://cve.now/CVE-2026-25986): ImageMagick has a heap buffer overflow in YUV 4:2:2 decoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25985](https://cve.now/CVE-2026-25985): Memory allocation with excessive without limits in the internal SVG decoder

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25983](https://cve.now/CVE-2026-25983): ImageMagick has Use After Free in MSLStartElement in "coders/msl.c"

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25982](https://cve.now/CVE-2026-25982): ImageMagick Has Heap Out-of-Bounds Read in DCM Decoder (ReadDCMImage)

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25971](https://cve.now/CVE-2026-25971): ImageMagick's MSL: Stack overflow in ProcessMSLScript

- Severity: Medium 6.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25970](https://cve.now/CVE-2026-25970): ImageMagick SIXEL Decoder Has Signed Integer Overflow, Leading to Memory Corruption

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25969](https://cve.now/CVE-2026-25969): ImageMagick has Memory Leak in coders/ashlar.c

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25968](https://cve.now/CVE-2026-25968): ImageMagick has MSL attribute stack buffer overflow that leads to out of bounds write.

- Severity: High 7.4
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25967](https://cve.now/CVE-2026-25967): ImageMagick has stack buffer overflow in FTXT reader via oversized integer field

- Severity: High 7.4
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25965](https://cve.now/CVE-2026-25965): ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy

- Severity: High 8.6
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25898](https://cve.now/CVE-2026-25898): Imagemagick Has Global Buffer Overflow (OOB Read) via Negative Pixel Index in UIL and XPM Writer

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25897](https://cve.now/CVE-2026-25897): ImageMagick has heap overflow in sun decoder on 32-bit systems that can result in out of bounds write

- Severity: Medium 6.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25799](https://cve.now/CVE-2026-25799): ImageMagick has Division-by-Zero in YUV sampling factor validation, which leads to crash

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25798](https://cve.now/CVE-2026-25798): ImageMagick has NULL Pointer Dereference in ClonePixelCacheRepository via crafted image

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25797](https://cve.now/CVE-2026-25797): ImageMagick vulnerable to Code injection via PostScript header in ps coders

- Severity: Medium 5.7
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25796](https://cve.now/CVE-2026-25796): ImageMagick has memory leak of watermark Image object in ReadSTEGANOImage on multiple error/early-return paths

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25795](https://cve.now/CVE-2026-25795): ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25794](https://cve.now/CVE-2026-25794): ImageMagick has heap-buffer-overflow via signed integer overflow in \`WriteUHDRImage\` when writing UHDR images with large dimensions

- Severity: High 8.2
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25638](https://cve.now/CVE-2026-25638): ImageMagick has memory leak in msl encoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-25637](https://cve.now/CVE-2026-25637): ImageMagick: Possible memory leak in ASHLAR encoder

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-24485](https://cve.now/CVE-2026-24485): ImageMagick: Infinite loop vulnerability when parsing a PCD file

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-24484](https://cve.now/CVE-2026-24484): ImageMagick: Converting multi-layer nested MVG to SVG can cause DoS

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-24481](https://cve.now/CVE-2026-24481): ImageMagick has Possible Heap Information Disclosure in PSD ZIP Decompression

- Severity: High 7.5
- Published: Feb 24, 2026
- Affected: fixed in 14.10.3.
- Fixed in 14.10.3 (released Feb 23, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-23952](https://cve.now/CVE-2026-23952): ImageMagick has a NULL pointer dereference in MSL parser via \<comment\> tag before image load

- Severity: Medium 6.5
- Published: Jan 22, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 3 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-23874](https://cve.now/CVE-2026-23874): ImageMagick's MSL: Stack overflow via infinite recursion in ProcessMSLScript

- Severity: Medium 5.5
- Published: Jan 20, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2026-22770](https://cve.now/CVE-2026-22770): ImageMagick vulnerable to Release of Invalid Pointer in BilateralBlur when memory allocation fails

- Severity: Medium 6.5
- Published: Jan 20, 2026
- Affected: fixed in 14.10.2.
- Fixed in 14.10.2 (released Jan 19, 2026, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-68950](https://cve.now/CVE-2025-68950): Magick's failure to limit MVG mutual references forming a loop

- Severity: Medium 4.0
- Published: Dec 30, 2025
- Affected: fixed in 14.10.1.
- Fixed in 14.10.1 (released Dec 30, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-68618](https://cve.now/CVE-2025-68618): Magick's failure to limit the depth of SVG file reads caused a DoS attack.

- Severity: Medium 5.3
- Published: Dec 30, 2025
- Affected: fixed in 14.10.1.
- Fixed in 14.10.1 (released Dec 30, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-68469](https://cve.now/CVE-2025-68469): ImageMagick vulnerable to heap-buffer-overflow

- Severity: Low 2.0
- Published: Dec 18, 2025
- Affected: fixed in 13.2.0.
- Fixed in 13.2.0 (released Jul 24, 2023, 878 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-62594](https://cve.now/CVE-2025-62594): ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS)

- Severity: Medium 4.7
- Published: Oct 27, 2025
- Affected: through 14.9.0.
- Fixed in 14.9.1 (released Oct 29, 2025, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-57807](https://cve.now/CVE-2025-57807): ImageMagick BlobStream Forward-Seek Under-Allocation

- Severity: Low 3.8
- Published: Sep 5, 2025
- Affected: fixed in 14.8.2.
- Fixed in 14.8.2 (released Sep 1, 2025, 4 days before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55298](https://cve.now/CVE-2025-55298): ImageMagick Format String Bug in InterpretImageFilename leads to arbitrary code execution

- Severity: High 7.5
- Published: Aug 26, 2025
- Affected: fixed in 14.8.1.
- Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55212](https://cve.now/CVE-2025-55212): ImageMagick affected by divide-by-zero in ThumbnailImage via montage -geometry ":" leads to crash

- Severity: Low 3.7
- Published: Aug 26, 2025
- Affected: fixed in 14.8.1.
- Fixed in 14.8.1 (released Aug 26, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55160](https://cve.now/CVE-2025-55160): ImageMagick Undefined Behavior (function-type-mismatch) in CloneSplayTree

- Severity: Medium 6.1
- Published: Aug 13, 2025
- Affected: fixed in 14.8.0.
- Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55154](https://cve.now/CVE-2025-55154): ImageMagick: integer overflows in MNG magnification

- Severity: High 8.8
- Published: Aug 13, 2025
- Affected: fixed in 14.8.0.
- Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-55004](https://cve.now/CVE-2025-55004): ImageMagick: heap-buffer overflow read in MNG magnification with alpha

- Severity: High 7.6
- Published: Aug 13, 2025
- Affected: fixed in 14.8.0.
- Fixed in 14.8.0 (released Aug 13, 2025, the day of disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53101](https://cve.now/CVE-2025-53101): ImageMagick has Stack Buffer Overflow in image.c

- Severity: High 7.4
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53019](https://cve.now/CVE-2025-53019): ImageMagick has Memory Leak in magick stream

- Severity: Low 3.7
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53015](https://cve.now/CVE-2025-53015): ImageMagick has XMP profile write that triggers hang due to unbounded loop

- Severity: High 7.5
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2025-53014](https://cve.now/CVE-2025-53014): ImageMagick has Heap Buffer Overflow in InterpretImageFilename

- Severity: Low 3.7
- Published: Jul 14, 2025
- Affected: fixed in 14.7.0.
- Fixed in 14.7.0 (released Jul 13, 2025, 1 day before disclosure).
- The latest release, 15.1.0, is not affected.

### [CVE-2023-1289](https://cve.now/CVE-2023-1289): A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault.

- Severity: Unrated
- Published: Mar 23, 2023
- Affected: fixed in 13.0.0.
- Fixed in 13.0.0 (released Mar 13, 2023, 10 days before disclosure).
- The latest release, 15.1.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/nuget/magick.net-q16-hdri-openmp-x64
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.